Session.Abandon();
 FormsAuthentication.SignOut();
 Response.Redirect(FormsAuthentication.LoginUrl);

Should do it...don't forget the redirect...

I think I once looped through cookies collection before redirect and set an earlier expires date.

Nah...doesn't matter where on site you send them. Just need to redirect to be sure that everything is reset for current user. 

Daniel, when I run the code the Session (or HttpContext.Current.Session) object is null. I'm running MVC obviously - any ideas on how to tackle that?

Also, I've tried adding the following to web.config:

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
     ...
      <remove name="Session"/>
      <add name="Session" type="System.Web.SessionState.SessionStateModule"/>
    </modules>

Hi Daniel,

I'm trying to understand something similar.... 

My logout action looks like this:

        public virtual ActionResult Logout(string returnUrl)
        {

            // Log out user:
            ClearSessionValues();                       
            FormsAuthentication.SignOut();

            // Get anonymous logged-out user ID:
            var anonymousUserId = PrincipalInfo.CurrentPrincipal.GetContactId();   //doesn't work, still returns logged-in user ID

            // do some stuff.... etc.

            return Redirect(returnUrl);
        }

As you can see, I want to get a new anonymous user ID from PrincipalInfo.CurrentPrincipal.GetContactId() after logging the user out.  Is that possible?  It seems like my call to PrincipalInfo.CurrentPrincipal.GetContactId() still returns the logged-in ID.  Your comments above seem to indicate that I must redirect to another action first.  Is that right?

Thanks,

 - Ken

Yes. If you don't redirect you will get some strange things like that. The current request still has authentication cookies etc. Redirecting will clear everything...

is it cookieless?

if (FormsAuthentication.CookieMode != HttpCookieMode.UseCookies)
{
Response.Redirect(loginurl, false);
}
else
{
Response.Redirect(loginurl, false);
}

@ K Khan -

We're using FormsAuthentication.CookieMode == HttpCookieMode.UseDeviceProfile - meaning it might/or might not use cookies depending on the browser settings.

Hmmmm, what would be the "correct" way to capture the anonymous user ID after every logout? 

We cannot predict where our logout action redirects to because it redirects to "whatever page the user was viewing when the clicked logout".  (so that could be ANY page).

Is there some event, or something, that I can tap into to reliably get that anonymous ID after a logout?

https://msdn.microsoft.com/en-us/library/system.web.httprequest.anonymousid.aspx

/K

According to Microsoft: The SignOut method removes the forms-authentication ticket information from the cookie or the URL if CookiesSupported is false.